5e514532df
- Added IIssuerDirectory interface for managing VEX document issuers, including methods for registration, revocation, and trust validation. - Created InMemoryIssuerDirectory class as an in-memory implementation of IIssuerDirectory for testing and single-instance deployments. - Introduced ISignatureVerifier interface for verifying signatures on VEX documents, with support for multiple signature formats. - Developed SignatureVerifier class as the default implementation of ISignatureVerifier, allowing extensibility for different signature formats. - Implemented handlers for DSSE and JWS signature formats, including methods for verification and signature extraction. - Defined various records and enums for issuer and signature metadata, enhancing the structure and clarity of the verification process.
166 lines
5.1 KiB
JSON
166 lines
5.1 KiB
JSON
{
|
|
"$schema": "https://stellaops.org/schemas/policy/determinism-fixture-v1.json",
|
|
"version": "1.0.0",
|
|
"description": "Determinism fixtures for Policy Engine scoring and decision APIs",
|
|
"fixtures": [
|
|
{
|
|
"fixture_id": "DET-001",
|
|
"name": "Basic Scoring Determinism",
|
|
"description": "Verify that scoring produces identical output for identical input",
|
|
"input": {
|
|
"finding_id": "CVE-2024-0001",
|
|
"tenant_id": "default",
|
|
"profile_id": "risk-profile-001",
|
|
"signals": {
|
|
"cvss_base": 7.5,
|
|
"exploitability": 2.8,
|
|
"impact": 5.9
|
|
}
|
|
},
|
|
"expected_output": {
|
|
"severity": "high",
|
|
"raw_score": 7.5,
|
|
"signal_order": ["cvss_base", "exploitability", "impact"],
|
|
"assertions": [
|
|
"signal_contributions keys are alphabetically ordered",
|
|
"scored_at is from context, not wall clock"
|
|
]
|
|
}
|
|
},
|
|
{
|
|
"fixture_id": "DET-002",
|
|
"name": "Multi-Finding Ordering",
|
|
"description": "Verify that multiple findings are returned in stable order",
|
|
"input": {
|
|
"findings": [
|
|
{"finding_id": "CVE-2024-0003", "cvss_base": 5.0},
|
|
{"finding_id": "CVE-2024-0001", "cvss_base": 9.8},
|
|
{"finding_id": "CVE-2024-0002", "cvss_base": 7.5}
|
|
]
|
|
},
|
|
"expected_output": {
|
|
"finding_order": ["CVE-2024-0001", "CVE-2024-0002", "CVE-2024-0003"],
|
|
"assertions": [
|
|
"findings sorted alphabetically by finding_id",
|
|
"order is stable across multiple runs"
|
|
]
|
|
}
|
|
},
|
|
{
|
|
"fixture_id": "DET-003",
|
|
"name": "Decision Summary Ordering",
|
|
"description": "Verify severity counts are in canonical order",
|
|
"input": {
|
|
"decisions": [
|
|
{"severity": "low", "count": 5},
|
|
{"severity": "critical", "count": 1},
|
|
{"severity": "medium", "count": 3},
|
|
{"severity": "high", "count": 2}
|
|
]
|
|
},
|
|
"expected_output": {
|
|
"severity_order": ["critical", "high", "medium", "low", "info"],
|
|
"assertions": [
|
|
"severity_counts keys follow canonical order",
|
|
"missing severities are either omitted or zero-filled consistently"
|
|
]
|
|
}
|
|
},
|
|
{
|
|
"fixture_id": "DET-004",
|
|
"name": "Deprecated Field Absence (v2.0)",
|
|
"description": "Verify deprecated fields are not present in v2.0 output",
|
|
"input": {
|
|
"finding_id": "CVE-2024-0001",
|
|
"cvss_base": 7.5,
|
|
"version": "2.0"
|
|
},
|
|
"expected_output": {
|
|
"absent_fields": [
|
|
"normalized_score",
|
|
"top_severity_sources",
|
|
"source_rank"
|
|
],
|
|
"present_fields": [
|
|
"severity",
|
|
"raw_score",
|
|
"trust_weights"
|
|
],
|
|
"assertions": [
|
|
"normalized_score is not serialized",
|
|
"trust_weights replaces top_severity_sources"
|
|
]
|
|
}
|
|
},
|
|
{
|
|
"fixture_id": "DET-005",
|
|
"name": "Legacy Compatibility Mode (v1.5)",
|
|
"description": "Verify deprecated fields are present when legacy mode enabled",
|
|
"input": {
|
|
"finding_id": "CVE-2024-0001",
|
|
"cvss_base": 7.5,
|
|
"options": {
|
|
"include_legacy_normalized_score": true
|
|
}
|
|
},
|
|
"expected_output": {
|
|
"present_fields": [
|
|
"normalized_score",
|
|
"severity",
|
|
"raw_score"
|
|
],
|
|
"assertions": [
|
|
"normalized_score is present for backwards compatibility",
|
|
"severity is canonical (high, not HIGH)"
|
|
]
|
|
}
|
|
},
|
|
{
|
|
"fixture_id": "DET-006",
|
|
"name": "Signal Contribution Ordering",
|
|
"description": "Verify signal contributions maintain stable key order",
|
|
"input": {
|
|
"signals": {
|
|
"zeta_factor": 0.5,
|
|
"alpha_score": 1.0,
|
|
"beta_weight": 0.75
|
|
}
|
|
},
|
|
"expected_output": {
|
|
"contribution_order": ["alpha_score", "beta_weight", "zeta_factor"],
|
|
"assertions": [
|
|
"signal_contributions keys are alphabetically sorted",
|
|
"contribution values are deterministic decimals"
|
|
]
|
|
}
|
|
},
|
|
{
|
|
"fixture_id": "DET-007",
|
|
"name": "Timestamp Determinism",
|
|
"description": "Verify timestamps come from context, not wall clock",
|
|
"input": {
|
|
"finding_id": "CVE-2024-0001",
|
|
"context": {
|
|
"evaluation_time": "2025-12-06T10:00:00Z"
|
|
}
|
|
},
|
|
"expected_output": {
|
|
"scored_at": "2025-12-06T10:00:00Z",
|
|
"assertions": [
|
|
"scored_at matches context.evaluation_time exactly",
|
|
"no random GUIDs in output"
|
|
]
|
|
}
|
|
}
|
|
],
|
|
"test_requirements": {
|
|
"snapshot_equality": "Identical inputs must produce byte-for-byte identical JSON",
|
|
"cross_environment": "Output must match across CI, local, and production",
|
|
"ordering_stability": "Collection order must be deterministic and documented"
|
|
},
|
|
"migration_notes": {
|
|
"v1.5": "Enable legacy mode with include_legacy_normalized_score for backwards compatibility",
|
|
"v2.0": "Remove all deprecated fields, trust_weights replaces source ranking"
|
|
}
|
|
}
|